Backport http://trac.webkit.org/changeset/36683 to the release ...

third_party/WebKit/WebCore/rendering/RenderTableSection.cpp

 /*
  * Copyright (C) 1997 Martin Jones (mjones@kde.org)
  *           (C) 1997 Torben Weis (weis@kde.org)
  *           (C) 1998 Waldo Bastian (bastian@kde.org)
  *           (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  * Copyright (C) 2003, 2004, 2005, 2006, 2008 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Alexey Proskuryakov (ap@nypop.com)
  *
  * This library is free software; you can redistribute it and/or
@@ skipping 152 matching lines @@
 {
     int nRows = m_gridRows;
     if (numRows > nRows) {
         if (numRows > static_cast<int>(m_grid.size())) {
             size_t maxSize = numeric_limits<size_t>::max() / sizeof(RowStruct);
             if (static_cast<size_t>(numRows) > maxSize)
                 return false;
             m_grid.grow(numRows);
         }
         m_gridRows = numRows;
-        int nCols = table()->numEffCols();
+        int nCols = max(1, table()->numEffCols());
         CellStruct emptyCellStruct;
         emptyCellStruct.cell = 0;
         emptyCellStruct.inColSpan = false;
         for (int r = nRows; r < numRows; r++) {
             m_grid[r].row = new Row(nCols);
             m_grid[r].row->fill(emptyCellStruct);
             m_grid[r].rowRenderer = 0;
             m_grid[r].baseline = 0;
             m_grid[r].height = Length();
         }
@@ skipping 904 matching lines @@
             else
                 *stream << cellAt(r, c).cell << "null cell ";
         }
         *stream << endl << ind;
     }
     RenderContainer::dump(stream,ind);
 }
 #endif
 
 } // namespace WebCore